Archives

Configuring IPsec IKEv2 in OpenWrt 15.05

The interoperability of IPsec implementations on various platforms has been becoming better and better over the last few years. For example, Windows 7 and newer releases fully support the IKEv2 (RFC 4306) and MOBIKE (RFC 4555) standards, and iOS started to support configuration of IKEv2 in the GUI since version 9.0.

In this tutorial, we’ll install strongSwan 5.3.3 in openwrt 15.05, configure it to provide IKEv2 service with public key authentication of the server and username/password based authentication of the clients using EAP-MSCHAP v2, and finally setup the VPN clients in Windows, Android and iOS so they can connect to it. Much of the complexity of IKEv2 configuration lies in the creation of SSL certificates.

Creating CA and server certificates

I recommend using XCA to create and maintain your root CA for your IKEv2 service. iOS silently refuses to trust CA certificates with MD5 signatures. So make sure to create CA certificates with SHA1, or better SHA256, signatures. Export your CA certificate in DER format. In the configuration example below, our CA cert is exported as file ZhangsRootCA2.cer. You are advised to upload the CA certificate to a secured web server or mail it to your own E-mail accounts.

Different IPsec implementations have different requirements on the server certificate. See the strongSwan wiki article for details. These requirements can be satisfied in XCA by making the following changes to a new certificate based on its HTTPS_server template:

Add all domain names and IP addresses of the IPsec server to the “X509v3 Subject Alternative Name” in the type of DNS and IP. IP addresses can be added to the SAN attribute as both DNS and IP to achieve best compatibility.

Here are the important details of an example IPsec server certificate created using XCA:

Circumventing the PMTUD Problem

It’s a common practice in IPsec implementations to set the MTU of the IPsec tunnel interface to 1400 or lower. You won’t experience Path MTU Discovery problems if the MTU of your WAN interface is standard, which is 1500 in the case of Ethernet, or 1492 in the case of PPPoE. However, if the MTU of your WAN interface is significantly lower than 1500, you need to set the MTU of the installed routes for IPsec clients to a value lower than 1400, which can be achieved using the strongswan kernel-netlink module.

The MTU of my PPPoE WAN interface is 1442. To prevent IPsec clients from running into PMTUD problems, I have to change the mtu option in /etc/strongswan.d/charon/kernel-netlink.conf to around 1350:

# MTU to set on installed routes, 0 to disable.
mtu = 1352

Testing

Now stop the IPsec IKE daemon and restart it in foreground, so that we can immediately see its log messages on the ssh console:

root@OpenWrt:~# ipsec stop
root@OpenWrt:~# ipsec start --nofork

After testing is done, interrupt the ipsec start –nofork command by pressing Ctrl-C and start ipsec again by typing the following command:

root@OpenWrt:~# ipsec start

We can check the detailed information about connections by typing the ipsec status and ipsec statusall commands.

Import the CA certificate ZhangsRootCA2.der. When opening the certificate, you’ll be prompted whether to open with the android “Certificate Installer” or the strongSwan “Import certificate” utility. If you’re using the CA certificate for IPsec only, you may import it to the strongSwan app, instead of the system certificate store of your Android device.

Open the strongSwan app, and tap ADD VPN Profile.

Edit the profile as follows. Uncheck the Select automatically option under “CA certificate:” and manually select the CA certificate we just imported. Tap Save.

Import the CA certificate, ZhangsRootCA2.cer, to the Trusted Root Certification Authorities / Certificates folder of the system certificate store.

Double-click the certificate file, click Open and then Install Certificate…. You must choose Local Computer as Store Location. On the Certificate Store popup, choose the option Place all certificates in the following store. Click Browse… and choose the Trusted Root Certification Authorities / Certificates folder. Click Next and then Finish to complete the certificate import.

By default, Windows 10 IPsec client adds a route to the remote network based on its IPv4 address class. If you want to set the default gateway on the remote network, you need to change the adapter settings of the VPN connection:

On the Network and Internet / VPN settings page, click Change Adapter Settings. Right-click the VPN connection you just created and then click Properties / Networking tab / Internet Protocol Version 4 (TCP/IPv4) / Properties / Advanced(V)…. On the Advanced TCP/IP Properties dialog, check Use default gateway on the remote network. Click the OK buttons to close the configuration dialogs you just opened.

Note: Although Windows 10 can successfully get the remote DNS server addresses when establishing IPsec connections, it keeps querying the local DNS servers for resolving domain names. This can cause connectivity issues for GSLB (Global Server Load Balancing) domain names and those domain names under DNS-poisoning attacks. In such cases, you’re strongly advised to use a http proxy or a socks5 proxy server on the remote network.

The NetworkManager strongswan plugin hasn’t improved much over the years. It doesn’t work with EAP-MSCHAPv2 and its pre-shared key option doesn’t even include an input box for the key. We’ll have to stick with file-based configuration in Ubuntu 18.04.

whether a particular participant ID should be kept unique, with any new IKE_SA using an ID
deemed to replace all old ones using that ID. Participant IDs normally are unique, so a new
IKE_SA using the same ID is almost invariably intended to replace an old one.
The difference between no and never is that the daemon will replace old IKE_SAs when receiving an
INITIAL_CONTACT notify if the option is no but will ignore these notifies if never is configured.
The daemon also accepts the value replace which is identical to yes and the value keep to reject
new IKE_SA setups and keep the duplicate established earlier.

Thanks for the reply, there are options called “Der Public(.der)” and “Der Private(.der)” available. Both are in .der.
and XCA version is 1.3.2.
Tried both .der formats. No success. Something else must be wrong. But to make the key is right first.

I was using xca ver. 1.1.0 when writing the article. It provides two options only for exporting keys: PEM and DER. As for the latest version, you should obviously choose DER private, according to its latest documentation: http://xca.sourceforge.net/xca-7.html#ss7.2

Many thanks. Finally get iOS connected. Your tutorial is complete.
Turns out the racoon service on my stock openwrt is alive and un-configed. It intercepts each incoming VPN connection request before strongswan.